Responding to Uncertainty: The Importance of Covertness in Support for Retaliation to Cyber and Kinetic Attacks

• Published date: 01 November 2023
• DOI: http://doi.org/10.1177/00220027231153580
• Author: Kathryn Hedgecock,Lauren Sukin
• Date: 01 November 2023
• Subject Matter: Articles

Article

Journal of Conf‌lict Resolution

2023, Vol. 67(10) 1873–1903

© The Author(s) 2023

Article reuse guidelines:

sagepub.com/journals-permissions

DOI: 10.1177/00220027231153580

journals.sagepub.com/home/jcr

Responding to Uncertainty:

The Importance of Covertness

in Support for Retaliation to

Cyber and Kinetic Attacks

Kathryn Hedgecock

1

and Lauren Sukin

2



Abstract

This paper investigates the escalation dynamics of cyber attacks. Two main theories

have been advanced. First, “means-based”theory argues attack type determines re-

sponse; cyber attacks are less likely to escalate than kinetic attacks. Second, “effects-

based”theory argues an attack’s material consequences determine the likelihood of

retaliation. We advance a third perspective, arguing that the covertness of an attack has

the largest effect on its propensity towards escalation. We identify two characteristics

of covertness that affect support for retaliation: the certainty of attribution and its

timing. We use a survey experiment to assess public support for retaliation, while

varying the means, effects, timing, and attribution certainty of attacks. We f‌ind no

evidence for the effects-based approach, instead f‌inding high levels of support for

retaliation regardless of an attack’s scale. We f‌ind that the most signif‌icant contributor

to support for retaliation is an attack’s covertness.

Keywords

Cyber, Escalation, Deterrence, Attribution, Covert Action

1

United States Military Academy, West Point, NY

2

London School of Economics and Political Science, London, UK

Corresponding Author:

Lauren Sukin, London School of Economics and Political Science, Houghton St., London WC2A 2AE, UK.

Email: l.sukin@lse.ac.uk

Introduction

The vulnerability of critical infrastructure and f‌inancial systems to cyber operations

remains a primary concern for national security. Protecting the state from cyber op-

erations requires active deterrent measures through intelligence gathering, monitoring,

and public-private cooperation in defense. However, when deterrence fails and ma-

licious cyber activity occurs, questions arise about the ‘approprate’response that

balances escalation and deterrence (Borghard and Lonergan 2019). In seeking to

understand how states choose to respond to cyber attacks,

1

one important consideration

is the signif‌icant public debate surrounding them.

Scholars have suggested public support for conf‌lict may encourage governments to

engage, while public opposition to conf‌lict can restrain government behavior

(Haesebrouck 2019;Kertzer and Brutger 2016;Kertzer et al. 2020;Levendusky and

Horowitz 2012;Tomz and Weeks2020). Currently, there is only a nascent literature on

how the public reacts to cyber attacks. Survey work has found the public is less likely to

support retaliation against cyber operations than against kinetic operations that produce

the same effects (Kreps and Schneider 2019). It is not particularly clear why this is:

psychological responses to cyber and conventional terrorism are similar (Gross et al.

2016), and individual concern about cybersecurity issues is low and resistant to change

(Kostyuk and Wayne 2020). At least the scale of the cyber attack does seem to matter:

scholars have found support for retaliation against cyber attacks with casualties (Kreps

and Das 2017;Shandler et al. 2021) but a preference for restraint in response to electoral

interference (Tomz et al. 2020). Existing experimental surveys provide an important

foundation, but they leave many questions unanswered. While some existing research

has found attitudes about cyber and kinetic conf‌licts differ, many existing surveys do

not address the mechanisms by which these differences arise. One exception is Snider

et al. 2021 which f‌inds threat perception to be an important moderator for retaliation

support.

We use a vignette survey experiment to better understand public attitudes about

cyber attacks. We identify the conditions under which the public supports retaliation

against such operations, and we delineate the differences between public perceptions of

cyber and kinetic attacks. In doing so, we depart from existing work by seeking to

understand the specif‌ic mechanisms underpinning attitudes about cyber attacks. In

particular, we f‌ind the clandestine nature of attacks common in the cyber domain, with

long discovery times and uncertain attribution, dampen retaliatory support. We f‌ind

physical attacks that are similarly covert are also less likely to prompt retaliatory

support. This previously understudied feature of attacks can help us understand when

and why cyber incidents lead to public calls for retaliation.

Attitudes on Cyber and Kinetic Conf‌lict

Despite its increasing prevalence in the world, research on the cyber domain has yet to

reach a conclusion on whether retaliation for a cyber operation is more likely to lead to

1874 Journal of Conf‌lict Resolution 67(10)